gowalk-cicd 1.0.17 → 1.0.18

package/README.md

@@ -103,6 +103,33 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Private git dependencies (Flutter)
+
+A Flutter app can depend on private git packages:
+
+```yaml
+dependencies:
+  my_package:
+    git: https://github.com/my-org/my_package.git
+```
+
+The runner has no credentials for those, so `flutter pub get` fails with
+`could not read Username for 'https://github.com'`. Embedding a PAT in the URL
+works but publishes the token into your source and into every copy of the
+lockfile.
+
+Set the repository **secret** `GIT_PRIVATE_TOKEN` instead — a PAT with `repo`
+read access — and the workflow rewrites `https://github.com/` to an
+authenticated remote for the duration of the job. Plain URLs keep working and
+the token lives in one revocable place:
+
+```bash
+gh secret set GIT_PRIVATE_TOKEN --repo my-org/my-app
+```
+
+Without the secret the step is skipped, so repos that do not need it are
+unaffected.
+
 ### Localized release notes
 
 Both stores pick up per-locale release notes from committed files:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.17
+1.0.18

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.17
+1.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -143,6 +143,21 @@ jobs:
         with:
           channel: stable
           cache: true
+      # Flutter apps can depend on private git packages. Most repos in this fleet
+      # embed a PAT directly in the pubspec URL, which publishes the token into
+      # source and into every fork of the lockfile. Setting the optional
+      # GIT_PRIVATE_TOKEN secret instead lets plain
+      # https://github.com/<org>/<repo>.git URLs resolve on the runner, so the
+      # token lives in one revocable place. No secret, no step — repos that do
+      # not need it are unaffected.
+      - name: Authenticate private git dependencies
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' && secrets.GIT_PRIVATE_TOKEN != '' }}
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations